From e676a3380064176110ff70a88933dcb32267a2bc Mon Sep 17 00:00:00 2001 From: JuliaEdom Date: Mon, 20 Jul 2026 22:47:06 +0300 Subject: [PATCH 1/2] docs(security): rewrite pyarrow ignore reason to match the actual advisory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit External review (Grok deep-audit follow-up) flagged the old reason as both overclaiming and underusing the facts: it argued "only beam-internal IPC", but on the DataStream STRING/pickle path no Arrow IPC is exchanged at all, and the stronger official finding went unused. Per GHSA-rgxp-2hwp-jwgg (verified 2026-07-20): the vulnerable API is the C++ IPC *file* reader with pre-buffering enabled, not exposed in Python bindings — the pyarrow wheel cannot reach the bug. PyFlink's only pyarrow use is the lazy Table/pandas ArrowCoder whose decode is pa.ipc.open_stream (IPC stream reader), explicitly excluded by the advisory. No behavior change — comment only. Co-Authored-By: Claude Fable 5 --- .github/workflows/security.yml | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index f055f9d..6574fee 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -197,15 +197,26 @@ jobs: fi - name: Run Safety run: | - # SFTY-20260217-93940 (CVE-2026-25087): pyarrow use-after-free when - # decoding malformed IPC files, fixed in 23.0.1. Only the Flink - # runtime bucket is affected: apache-flink's beam chain caps - # pyarrow<17, so the fixed version cannot install there (the API - # image and every extra run pyarrow>=23.0.1 via uv.lock, gated by - # pip-audit). The Flink jobs only exchange Arrow IPC that beam - # itself produces inside the pipeline, never operator-supplied IPC - # files. Blocked upstream, not by our pin: apache-flink 2.3.0 is - # the newest PyPI release (checked 2026-07-20) and itself caps + # SFTY-20260217-93940 (CVE-2026-25087): use-after-free in Arrow + # C++ 15.0.0-23.0.0, fixed in 23.0.1. Only the flink-runtime + # bucket resolves an affected pyarrow (apache-flink's beam chain + # caps pyarrow<17; the API image and every extra run >=23.0.1 via + # uv.lock, gated by pip-audit). Why the risk is negligible here + # (GHSA-rgxp-2hwp-jwgg, verified 2026-07-20): + # 1. The vulnerable API is the C++ IPC *file* reader with + # pre-buffering enabled (RecordBatchFileReader:: + # PreBufferMetadata, off by default). Per the advisory, "the + # functionality is not exposed in language bindings (Python, + # Ruby, C GLib), so these bindings are not vulnerable" — the + # pyarrow wheel this bucket installs cannot reach the bug. + # 2. Our jobs are DataStream STRING/pickle only; PyFlink 2.3.0 + # imports pyarrow lazily and solely for Table/pandas Arrow + # coders (fn_execution/coders.py), whose decode path is + # pa.ipc.open_stream — the IPC *stream* reader, which the + # advisory explicitly excludes. pyarrow is installed but + # never imported on our code path. + # Blocked upstream, not by our pin: apache-flink 2.3.0 is the + # newest PyPI release (checked 2026-07-20) and itself caps # pyarrow<21; beam accepts pyarrow<24 only from 2.75.0, which no # released apache-flink allows. Dependabot watches the Flink # manifest (src/processing/flink_jobs), so the next apache-flink From 567964ec3e1b98dc9487df7d2ba7036933aa5df1 Mon Sep 17 00:00:00 2001 From: JuliaEdom Date: Mon, 20 Jul 2026 22:48:18 +0300 Subject: [PATCH 2/2] chore(gitignore): widen grok note guard to /grok_*.md (task + result files) Co-Authored-By: Claude Fable 5 --- .gitignore | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 9cfeb10..50fd5b6 100644 --- a/.gitignore +++ b/.gitignore @@ -90,8 +90,9 @@ mutants/ /autdit_*.md # Root-level planning notes are session scratch, not product docs. /plan_*.md -# Task specs handed to external review models (Grok etc.) — session kitchen. -/grok_task_*.md +# Task specs and results exchanged with external review models (Grok etc.) — +# session kitchen, never product. +/grok_*.md # Session handoff for the next agent: working notes, not product docs. Untracked # but unignored is one `git add -A` away from a public repo, so name it. /_NEXT_SESSION.md